From 556daf928e082aabceb6ed42033c319beb460fa6 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 18 Oct 2026 22:38:20 +0200 Subject: [PATCH] Prepare the existing contained Forgejo API login and silent read check --- .../wp80-development-entrypoints-r1/README.md | 5 +++ .../attended-api-login-advisory.json | 14 ++++++ .../attended-api-preparation.json | 45 +++++++++++++++++++ docs/netkingdom-development.md | 31 +++++++++++-- ...gdom-security-blueprint-and-gap-closure.md | 2 + 5 files changed, 94 insertions(+), 3 deletions(-) create mode 100644 docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-login-advisory.json create mode 100644 docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-preparation.json diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md index 1d72007..6badcaf 100644 --- a/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md @@ -36,6 +36,11 @@ changes were preserved. The two postimage files retain exact published sources. credentialed path remains unverified because the owner transport refused. - `measurements.json`: bounded samples, command counts and explicit unknowns. No cold-onboarding or comparative performance claim is made. +- `attended-api-preparation.json`: exact existing-owner login/role and silent + invocation of the existing Tea probe. Installed Warden source pins and shell + syntax are checked; no new runner or credential-policy change is introduced. + This prepares the founder-run attempt and does not prove interactive login, + session revocation or authenticated API success. T33/T37 remain in progress until the actual Forgejo paths are accepted. T42 still waits on decision `ad88edeb-7c7c-486f-a695-1a7abae5b20c`; no source diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-login-advisory.json b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-login-advisory.json new file mode 100644 index 0000000..c64d7f5 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-login-advisory.json @@ -0,0 +1,14 @@ +{ + "id": "key-cape-oidc-login", + "domain": "forgejo-admin-workload-kv-read", + "handoff": { + "auth_method": "browser OIDC via key-cape / Keycloak at auth/netkingdom", + "path_template": null, + "fetch_command": "bao login -no-print -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read", + "policy_ref": null, + "exec_capable": true + }, + "next_action": "Run the attended login and reviewed operation only inside the contained envelope: `warden access --exec -- `. The private helper is preflighted, all output is suppressed, and the session is revoked and removed afterward.", + "advisory_exit_code": 0, + "login_or_fetch_executed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-preparation.json b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-preparation.json new file mode 100644 index 0000000..91211a8 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/attended-api-preparation.json @@ -0,0 +1,45 @@ +{ + "prepared": true, + "executed": false, + "api_success_proven": false, + "command_recipe": "wp80_api_receipt_dir=$(mktemp -d /tmp/wp80-forgejo-api.XXXXXX)\nBAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access key-cape-oidc-login --domain forgejo-admin-workload-kv-read --exec -- sh -c 'umask 077; exec warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py > \"$1\" 2>/dev/null' sh \"$wp80_api_receipt_dir/report.json\"\npython3 -m json.tool \"$wp80_api_receipt_dir/report.json\"\n", + "shell_syntax_check_exit_code": 0, + "login_lane": "key-cape-oidc-login", + "role": "forgejo-admin-workload-kv-read", + "resolved_login_command": "bao login -no-print -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read", + "role_source": "/home/worsch/ops-warden/wiki/playbooks/forgejo-admin-api-token.md", + "login_semantics_source": "Installed warden.proxy.proxy_attended_login_exec; captured login, silent child, self-revocation and helper removal", + "login_role_current_runtime_verification": "Not yet executed; current role functionality and actual API reads remain unverified", + "new_runner_created": false, + "new_credential_policy_or_grant": false, + "source_pins": [ + { + "path": "/home/worsch/.local/share/uv/tools/ops-warden/lib/python3.12/site-packages/warden/cli.py", + "sha256": "196cd829d3dbfbd2333598a983687bde1f9bcdfadef95b2fd1d237c4a5f060a9", + "matches_owner_checkout": true + }, + { + "path": "/home/worsch/.local/share/uv/tools/ops-warden/lib/python3.12/site-packages/warden/proxy.py", + "sha256": "69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da", + "matches_owner_checkout": true + }, + { + "path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py", + "sha256": "2e56da76fbebd2601e07b2da3842aacc5236b67b969252265514d6b4a3af8ca8" + } + ], + "expected_receipt": { + "passed": true, + "whoami_exit_code": 0, + "repository_read_exit_code": 0, + "returned_identity_matches": true, + "expected_repository_returned": true, + "temporary_configuration_removed": true + }, + "separate_outer_requirements": [ + "Contained OIDC login handed off to child", + "Outer session self-revocation confirmed", + "Outer helper cleanup confirmed" + ], + "on_failure": "Keep the closed failure result. Empty report is not API evidence; do not broaden role or claim success." +} diff --git a/docs/netkingdom-development.md b/docs/netkingdom-development.md index ee47a31..abc9cc5 100644 --- a/docs/netkingdom-development.md +++ b/docs/netkingdom-development.md @@ -82,9 +82,34 @@ points at a retired Gitea host; that credential was not used against the current forge. No authenticated API result has been accepted. `warden plan 'oidc login forgejo admin' --json` identifies the existing -founder-required KeyCape OIDC/MFA login lane. That human login is still a -prerequisite to resolve through the owner path. The recorded route plans and -closed failure markers are in the [entrypoint evidence](changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md). +founder-required KeyCape OIDC/MFA login lane. Its existing role for reading this +credential is `forgejo-admin-workload-kv-read`, documented by the credential +owner. The founder can run the following in their own interactive terminal: + +```sh +wp80_api_receipt_dir=$(mktemp -d /tmp/wp80-forgejo-api.XXXXXX) +BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access key-cape-oidc-login --domain forgejo-admin-workload-kv-read --exec -- sh -c 'umask 077; exec warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py > "$1" 2>/dev/null' sh "$wp80_api_receipt_dir/report.json" +python3 -m json.tool "$wp80_api_receipt_dir/report.json" +``` + +This reuses Warden's contained login and existing credential route. The inner +command emits only the reviewed probe's metadata JSON into a private receipt; +both child streams stay silent to the outer login envelope. Warden revokes the +temporary OpenBao session and removes its helper, while the probe removes its +isolated Tea configuration. No API credential or login token is printed or +retained in that receipt. + +**Prepared, not executed:** this is the supported next attempt after the 403, +not proof that the current role/login works. Retain the outer Warden outcome as +well as the receipt. A missing/empty report means the API check has not produced +evidence. A report with `passed: true` must include successful identity and +repository reads; a revocation/cleanup failure remains a separate unresolved +outcome even if those reads succeeded. Do not rerun a failed command unchanged +or broaden the role to obtain a pass. + +This read check does not activate the separate Forgejo sign-in rollout. The +recorded route plans and closed failure markers are in the +[entrypoint evidence](changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md). ## Forgejo NetKingdom sign-in and repository privacy diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md index 4b1a410..22ed283 100644 --- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md +++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md @@ -607,6 +607,8 @@ Use an existing supported coding-agent access path and its stated build profile. Baseline: existing SSH read and ordinary source publication work. The installed Tea default targets retired Gitea and was not reused. The current owner-routed API attempt returned OpenBao 403 before the isolated Tea probe received a credential; no API operation ran. The route plan identifies founder-required KeyCape OIDC/MFA caller login. [Evidence and current commands](../docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md). This retained failure does not close T44. +Prepared the [exact founder-run contained login and API check](../docs/netkingdom-development.md#forgejo-git-and-api) using existing Warden role substitution, the existing owner credential route and installed Tea probe. No extra runner or policy grant. Installed Warden implementation matches the inspected owner source; the command's shell syntax is checked. Actual human login, successful API reads and session-revocation/cleanup evidence remain missing; T44 stays open. + ## T45 - Publish the verified browser entrypoint in existing discovery ```task